Today, GitHub shows me this message:
The message reads as:
GitHub users are now required to enable two-factor authentication as an additional security measure. Your activity on GitHub includes you in this requirement. You will need to enable two-factor authentication on your account before November 10, 2023, or be restricted from account actions.
When I click on the Button "Enable 2FA", the following page opens (I blurred the QR Code):
If I understand this page correctly, it wants me to:
How to do this, when
Make a screenshot of the QR Code. Your Linux distro should have a screenshot tool installed. Otherwise, find one in your package manager. Crop the screenshot with e.g. Gimp, and save it somewhere.
Next, install Authenticator. This is a small application which can scan QR codes and "verify them", whatever that means. In my distro, it is contained as Flatpak in the package manager. The above link also contains instructions how to install it via command line.
Open Authenticator and create a new account by clicking the "New account" button:
In the page that opens, click on the "Scan QR Code" symbol:
From the dropdown, choose "QR Code Image", and select the screenshot of the QR code, which you just made.
When scanning the QR code was successful, it will populate all entries for your new account:
Click "Add".
The new account will be created (Keep it, you need it in the future when you log in). Click on its "copy PIN to clipboard" button:
Paste the pin into the entry on the GitHub page with the QR code and click "Continue".
As a second step, it will ask you to download some backup codes (I forgot to make a screenshot of that). Well let's do that too, and save them, in for example a VeraCrypt container. Then click "continue" again.
Finally, you get a page like this:
Congratulations, You now have 2fa enabled on GitHub. Click on the "done" button, and it will redirect you to a GitHub configuration page. You do not have to make any changes there.
From now on, whenever you log in to GitHub, it will first ask you for your e-mail and password, as usual. Then it will also ask for a one time PIN, copied from the Authenticator app (we did that already once above).